The Centers for Medicare & Medicaid Services had a system for checking whether states submitted complete Medicaid managed-care financial reports.
It also had a system for checking whether some of the numbers in those reports might be wrong.
What it apparently did not have was a procedure for what to do when the second system found something.
A new Department of Health and Human Services Office of Inspector General report found limitations in CMS’s process for verifying state-submitted medical loss ratio data, including dozens of reports containing potential inaccuracies that CMS identified but did not pursue with the states involved.
The findings concern Medicaid managed-care medical loss ratios, or MLRs. An MLR measures the percentage of a plan’s revenue spent on covered health care services and quality-improvement activities. The federal standard is 85 percent, meaning a plan reaching that figure spent 85 percent on those purposes and the remaining 15 percent on administration and profit.
The numbers aren’t merely informational. States use past MLRs when developing future capitation rates, the fixed monthly amounts paid to managed-care plans for each enrolled beneficiary. States are required to develop those rates so plans can reasonably achieve an MLR of at least 85 percent.
That makes the accuracy of the underlying data rather important.
CMS Couldn’t Check More Than Half the Reports
OIG examined CMS’s oversight of 595 final MLR summary reports submitted by 44 states for the 2019 reporting year.
CMS used five accuracy checks covering four required MLR data elements. According to OIG, those checks identified 57 reports submitted by 16 states containing at least one potential inaccuracy.
There was another problem.
For three of the four required data elements, CMS needed additional information to perform its accuracy checks. But those underlying data elements were optional for states to submit.
The predictable happened.
CMS could not conduct each of four accuracy checks on more than half of the 595 reports. Depending on the check, CMS could test only 43 to 46 percent of them.
Where CMS did have enough information to perform the checks, it found potential problems.
Among the reports CMS could test, it identified 23 potentially inaccurate MLR numerators, 15 potentially inaccurate denominators using one check, 18 using another denominator check, and one potentially inaccurate adjusted MLR. OIG noted that additional optional data might have allowed CMS to identify additional potential inaccuracies.
CMS performed another check by comparing reported “member months” against enrollment information. It could perform that comparison for 448 of the 595 reports and identified 25 with potentially inaccurate member-month figures.
These were potential inaccuracies, not OIG findings that the figures were definitively wrong.
Determining that would have required another step.
And Then, Nothing
CMS itself told OIG that potential inaccuracies require further evaluation and possibly follow-up with states to determine whether the numbers are actually incorrect.
CMS did not follow up with the 16 states.
OIG found that the agency therefore missed an opportunity both to obtain corrected information where errors actually existed and to alert states so they could investigate the questionable data themselves.
Curiously, CMS did have procedures for chasing down missing information.
For the same 2019 reporting year, CMS followed up with states over missing MLR data and successfully obtained 192 initial or resubmitted reports from 19 states.
Its written procedures simply did not specify what employees should do about potential inaccuracies detected by CMS’s own accuracy checks.
Completeness, apparently, had a workflow. Accuracy was still waiting for one.
The Findings Stayed in Their Lane
OIG found another disconnect inside CMS.
As of October 2025, the CMS staff reviewing state-submitted MLR data did not share the results of their accuracy checks with the CMS employees responsible for reviewing states’ future capitation rates.
Those rates are precisely where historical MLR information can matter.
CMS reviews the prospective rates and approves managed-care contracts containing the final rates. OIG concluded that by not communicating the accuracy-check results internally, CMS missed an opportunity for those findings to inform its rate reviews.
OIG recommended that CMS establish procedures for handling potentially inaccurate data, share accuracy-review information with employees reviewing capitation rates, and improve the effectiveness of its MLR oversight, potentially by adding automated accuracy checks to its reporting portal.
CMS concurred with all three recommendations.
An Important Date on the Report Card
There is a significant caveat to the findings.
Although OIG issued the report in September 2026, the data it analyzed came from the 2019 reporting year.
CMS emphasized that point in its response, calling 2019 one of the earlier reporting periods for state MLR submissions and saying it has made substantial improvements since then. Those changes include an MLR toolkit, an optional standardized reporting template, a web-based submission portal and public release of plan-specific MLR data.
The agency also said it has already added automated checks preventing states from submitting reports with blank required fields and will consider expanding the system to perform automated accuracy checks. CMS has encouraged states to submit the optional data needed for additional verification and says it intends to continue doing so.
That means the OIG report does not establish that the same deficiencies persist today.
It does establish something narrower, and peculiar enough on its own.
CMS had financial reports that mattered to Medicaid managed-care oversight. It built checks designed to identify questionable numbers in those reports. Those checks found potential inaccuracies in reports from 16 states.
And when the warning lights came on, there was no procedure telling the agency what to do next.
